@peektravel/app-utilities 0.8.1 → 0.9.0

package/dist/index.cjs

@@ -207,6 +207,13 @@ function resolveAccessOptions(options) {
 }
 
 // src/errors.ts
+var FORBIDDEN_STATUS = 403;
+var PERMISSION_MESSAGE_PREFIX = "CNG request forbidden: the app is missing the required permission";
+var PERMISSION_MESSAGE_UNKNOWN = "CNG request forbidden: the app is missing a required permission";
+function buildPermissionMessage(permissions) {
+  if (permissions.length === 0) return PERMISSION_MESSAGE_UNKNOWN;
+  return `${PERMISSION_MESSAGE_PREFIX}${permissions.length > 1 ? "s" : ""}: ${permissions.join(", ")}`;
+}
 var AdminAccountRequiredError = class extends Error {
   /** The HTTP status that triggered this error. */
   statusCode = 418;
@@ -270,6 +277,23 @@ var CngApiError = class extends Error {
     this.body = body;
   }
 };
+var CngPermissionError = class extends Error {
+  /** The HTTP status that triggered this error. */
+  statusCode = FORBIDDEN_STATUS;
+  /**
+   * The permissions the gateway reported as missing, e.g. `["products:read"]`.
+   * Empty when the response body did not name any.
+   */
+  permissions;
+  /** The raw response body (parsed JSON when possible, otherwise text). */
+  body;
+  constructor(permissions, body, message) {
+    super(message ?? buildPermissionMessage(permissions));
+    this.name = "CngPermissionError";
+    this.permissions = permissions;
+    this.body = body;
+  }
+};
 var AcmeApiError = class extends Error {
   /** The HTTP status that triggered this error. */
   statusCode;
@@ -2122,6 +2146,12 @@ async function requestWithRetry(http, url, init, label, onResponse) {
   throw new RateLimitError();
 }
 
+// src/internal/sdk-headers.ts
+var SDK_HEADER_NAME = "x-peek-sdk";
+var SDK_PLATFORM = "js";
+var SDK_VERSION = "0.9.0";
+var SDK_HEADER_VALUE = `${SDK_PLATFORM}-${SDK_VERSION}`;
+
 // src/internal/peek/graphql-client.ts
 var isObject = (value) => typeof value === "object" && value !== null;
 var GraphQLClient = class {
@@ -2175,7 +2205,8 @@ var GraphQLClient = class {
   buildHeaders() {
     const headers = {
       "X-Peek-Auth": `Bearer ${this.options.getToken()}`,
-      "Content-Type": "application/json"
+      "Content-Type": "application/json",
+      [SDK_HEADER_NAME]: SDK_HEADER_VALUE
     };
     if (this.options.gatewayKey) {
       headers["pk-api-key"] = this.options.gatewayKey;
@@ -3973,182 +4004,182 @@ var PeekAccessService = class {
     return this.reviewService;
   }
   // ─── Product short-forms ─────────────────────────────────────────────────
-  /** All products (activities + add-ons). Delegates to {@link ProductService.getAllProducts}. */
+  /** All products (activities + add-ons). @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link ProductService.getAllProducts}. */
   getAllProducts() {
     return this.getProductService().getAllProducts();
   }
-  /** All activity products (excludes add-ons). Delegates to {@link ProductService.getAllActivities}. */
+  /** All activity products (excludes add-ons). @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link ProductService.getAllActivities}. */
   getAllActivities() {
     return this.getProductService().getAllActivities();
   }
-  /** All rental products. Delegates to {@link ProductService.getAllRentals}. */
+  /** All rental products. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link ProductService.getAllRentals}. */
   getAllRentals() {
     return this.getProductService().getAllRentals();
   }
-  /** All add-on products. Delegates to {@link ProductService.getAllAddons}. */
+  /** All add-on products. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link ProductService.getAllAddons}. */
   getAllAddons() {
     return this.getProductService().getAllAddons();
   }
-  /** An activity's custom questions. Delegates to {@link ProductService.getCustomQuestions}. */
+  /** An activity's custom questions. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link ProductService.getCustomQuestions}. */
   getCustomQuestions(productId) {
     return this.getProductService().getCustomQuestions(productId);
   }
   // ─── Account-user short-forms ─────────────────────────────────────────────
-  /** All active account users. Delegates to {@link AccountUserService.getAll}. */
+  /** All active account users. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link AccountUserService.getAll}. */
   getAllAccountUsers() {
     return this.getAccountUserService().getAll();
   }
-  /** Account user by id, or null. Delegates to {@link AccountUserService.getById}. */
+  /** Account user by id, or null. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link AccountUserService.getById}. */
   getAccountUserById(userId) {
     return this.getAccountUserService().getById(userId);
   }
   // ─── Resource-pool short-forms ────────────────────────────────────────────
-  /** All resource pools. Delegates to {@link ResourcePoolService.getAll}. */
+  /** All resource pools. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link ResourcePoolService.getAll}. */
   getAllResourcePools(mode) {
     return this.getResourcePoolService().getAll(mode);
   }
   // ─── Timeslot short-forms ─────────────────────────────────────────────────
-  /** Timeslots for an activity on a given date. Delegates to {@link TimeslotService.getForDay}. */
+  /** Timeslots for an activity on a given date. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link TimeslotService.getForDay}. */
   getTimeslotsForDay(productId, date, filter) {
     return this.getTimeslotService().getForDay(productId, date, filter);
   }
-  /** Single timeslot by id. Delegates to {@link TimeslotService.getById}. */
+  /** Single timeslot by id. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link TimeslotService.getById}. */
   getTimeslotById(timeslotId) {
     return this.getTimeslotService().getById(timeslotId);
   }
-  /** Set timeslot status. Delegates to {@link TimeslotService.setAvailability}. */
+  /** Set timeslot status. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link TimeslotService.setAvailability}. */
   setTimeslotAvailability(timeslotId, status) {
     return this.getTimeslotService().setAvailability(timeslotId, status);
   }
-  /** Set timeslot manifest notes. Delegates to {@link TimeslotService.setNotes}. */
+  /** Set timeslot manifest notes. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link TimeslotService.setNotes}. */
   setTimeslotNotes(timeslotId, manifestNotes) {
     return this.getTimeslotService().setNotes(timeslotId, manifestNotes);
   }
-  /** Assign or unassign guides on timeslots. Delegates to {@link TimeslotService.assignGuide}. */
+  /** Assign or unassign guides on timeslots. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link TimeslotService.assignGuide}. */
   assignTimeslotGuide(assignment) {
     return this.getTimeslotService().assignGuide(assignment);
   }
   // ─── Reseller short-forms ─────────────────────────────────────────────────
-  /** All reseller channels. Delegates to {@link ResellerService.getAllChannels}. */
+  /** All reseller channels. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link ResellerService.getAllChannels}. */
   getAllChannels(agentsPerChannel) {
     return this.getResellerService().getAllChannels(agentsPerChannel);
   }
   // ─── Promo-code short-forms ───────────────────────────────────────────────
-  /** All promo codes. Delegates to {@link PromoCodeService.getAll}. */
+  /** All promo codes. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link PromoCodeService.getAll}. */
   getAllPromoCodes() {
     return this.getPromoCodeService().getAll();
   }
-  /** Create a promo code. Delegates to {@link PromoCodeService.create}. */
+  /** Create a promo code. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link PromoCodeService.create}. */
   createPromoCode(input) {
     return this.getPromoCodeService().create(input);
   }
   // ─── Pricing short-forms ──────────────────────────────────────────────────
-  /** Create a pricing engine. Delegates to {@link PricingService.createEngine}. */
+  /** Create a pricing engine. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link PricingService.createEngine}. */
   createPricingEngine(input) {
     return this.getPricingService().createEngine(input);
   }
-  /** Update a pricing engine. Delegates to {@link PricingService.updateEngine}. */
+  /** Update a pricing engine. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link PricingService.updateEngine}. */
   updatePricingEngine(input) {
     return this.getPricingService().updateEngine(input);
   }
-  /** Delete a pricing engine (idempotent). Delegates to {@link PricingService.deleteEngine}. */
+  /** Delete a pricing engine (idempotent). @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link PricingService.deleteEngine}. */
   deletePricingEngine(engineId) {
     return this.getPricingService().deleteEngine(engineId);
   }
-  /** Upsert pricing overrides. Delegates to {@link PricingService.upsertOverrides}. */
+  /** Upsert pricing overrides. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link PricingService.upsertOverrides}. */
   upsertPricingOverrides(input) {
     return this.getPricingService().upsertOverrides(input);
   }
-  /** Clear pricing overrides for a set of activities. Delegates to {@link PricingService.clearOverrides}. */
+  /** Clear pricing overrides for a set of activities. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link PricingService.clearOverrides}. */
   clearPricingOverrides(input) {
     return this.getPricingService().clearOverrides(input);
   }
   // ─── Daily-note short-forms ───────────────────────────────────────────────
-  /** Today's daily note. Delegates to {@link DailyNoteService.getToday}. */
+  /** Today's daily note. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link DailyNoteService.getToday}. */
   getDailyNoteToday() {
     return this.getDailyNoteService().getToday();
   }
-  /** Update today's daily note. Delegates to {@link DailyNoteService.update}. */
+  /** Update today's daily note. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link DailyNoteService.update}. */
   updateDailyNote(note) {
     return this.getDailyNoteService().update(note);
   }
   // ─── Availability short-forms ─────────────────────────────────────────────
-  /** Availability times for an activity. Delegates to {@link AvailabilityService.getAvailabilityTimes}. */
+  /** Availability times for an activity. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link AvailabilityService.getAvailabilityTimes}. */
   getAvailabilityTimes(query) {
     return this.getAvailabilityService().getAvailabilityTimes(query);
   }
   // ─── Membership short-forms ───────────────────────────────────────────────
-  /** All memberships. Delegates to {@link MembershipService.getAll}. */
+  /** All memberships. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link MembershipService.getAll}. */
   getAllMemberships() {
     return this.getMembershipService().getAll();
   }
-  /** Purchase a membership. Delegates to {@link MembershipService.purchase}. */
+  /** Purchase a membership. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link MembershipService.purchase}. */
   purchaseMembership(input) {
     return this.getMembershipService().purchase(input);
   }
   // ─── Booking short-forms ──────────────────────────────────────────────────
-  /** Booking by id. Delegates to {@link BookingService.getById}. */
+  /** Booking by id. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.getById}. */
   getBookingById(bookingId, options) {
     return this.getBookingService().getById(bookingId, options);
   }
-  /** Bookings by time range. Delegates to {@link BookingService.searchByTimeRange}. */
+  /** Bookings by time range. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.searchByTimeRange}. */
   searchBookingsByTimeRange(input) {
     return this.getBookingService().searchByTimeRange(input);
   }
-  /** Bookings on a timeslot. Delegates to {@link BookingService.searchByTimeslot}. */
+  /** Bookings on a timeslot. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.searchByTimeslot}. */
   searchBookingsByTimeslot(timeslotId, options) {
     return this.getBookingService().searchByTimeslot(timeslotId, options);
   }
-  /** Guests on a booking. Delegates to {@link BookingService.getGuests}. */
+  /** Guests on a booking. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.getGuests}. */
   getBookingGuests(bookingId) {
     return this.getBookingService().getGuests(bookingId);
   }
-  /** Payments on file for a booking. Delegates to {@link BookingService.getPaymentsOnFile}. */
+  /** Payments on file for a booking. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.getPaymentsOnFile}. */
   getBookingPaymentsOnFile(bookingId) {
     return this.getBookingService().getPaymentsOnFile(bookingId);
   }
-  /** Append or overwrite operator notes. Delegates to {@link BookingService.appendNote}. */
+  /** Append or overwrite operator notes. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.appendNote}. */
   appendBookingNote(bookingId, note, mode) {
     return this.getBookingService().appendNote(bookingId, note, mode);
   }
-  /** Set booking check-in status. Delegates to {@link BookingService.setCheckinStatus}. */
+  /** Set booking check-in status. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.setCheckinStatus}. */
   setBookingCheckinStatus(bookingId, checkedIn) {
     return this.getBookingService().setCheckinStatus(bookingId, checkedIn);
   }
-  /** Cancel a booking. Delegates to {@link BookingService.cancel}. */
+  /** Cancel a booking. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.cancel}. */
   cancelBooking(bookingId, notes) {
     return this.getBookingService().cancel(bookingId, notes);
   }
-  /** Charge a booking. Delegates to {@link BookingService.makePayment}. */
+  /** Charge a booking. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.makePayment}. */
   makeBookingPayment(input) {
     return this.getBookingService().makePayment(input);
   }
-  /** Refund a booking payment. Delegates to {@link BookingService.refund}. */
+  /** Refund a booking payment. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.refund}. */
   refundBooking(input) {
     return this.getBookingService().refund(input);
   }
-  /** Create an invoice link. Delegates to {@link BookingService.createInvoiceLink}. */
+  /** Create an invoice link. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.createInvoiceLink}. */
   createBookingInvoiceLink(bookingId) {
     return this.getBookingService().createInvoiceLink(bookingId);
   }
-  /** List add-ons on a booking. Delegates to {@link BookingService.listAddons}. */
+  /** List add-ons on a booking. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.listAddons}. */
   listBookingAddons(bookingId) {
     return this.getBookingService().listAddons(bookingId);
   }
-  /** Add an add-on to a booking. Delegates to {@link BookingService.addAddon}. */
+  /** Add an add-on to a booking. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.addAddon}. */
   addBookingAddon(bookingId, input) {
     return this.getBookingService().addAddon(bookingId, input);
   }
-  /** Remove an add-on from a booking. Delegates to {@link BookingService.removeAddon}. */
+  /** Remove an add-on from a booking. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.removeAddon}. */
   removeBookingAddon(bookingId, input) {
     return this.getBookingService().removeAddon(bookingId, input);
   }
-  /** Create a booking. Delegates to {@link BookingService.create}. */
+  /** Create a booking. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link BookingService.create}. */
   createBooking(input) {
     return this.getBookingService().create(input);
   }
   // ─── Review short-forms ───────────────────────────────────────────────────
-  /** Reviews for an activity. Delegates to {@link ReviewService.getReviews}. */
+  /** Reviews for an activity. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link ReviewService.getReviews}. */
   getReviews(productId, reviewCount, reviewOffset) {
     return this.getReviewService().getReviews(productId, reviewCount, reviewOffset);
   }
@@ -4156,7 +4187,7 @@ var PeekAccessService = class {
 
 // src/internal/cng/endpoints.ts
 var CNG_EXTENDABLE_SLUG = "cng_backoffice_api-v1";
-var PRODUCTS_PATH = "api/v2/commerce-config/products";
+var PRODUCTS_PATH = "api/v2/app-registry/products?active=1";
 
 // src/models/cng/product.ts
 var ACTIVITY_PRODUCT_TYPE2 = "ACTIVITY";
@@ -4167,14 +4198,11 @@ function fromProductNodes(nodes) {
 }
 function fromProductNode(node) {
   return {
-    productId: node.id || "",
+    productId: node.id == null ? "" : String(node.id),
     name: node.name || "",
-    type: node.product_type || ACTIVITY_PRODUCT_TYPE2,
-    color: node.color_hex || "",
-    tickets: (node.tickets ?? []).map((ticket) => ({
-      id: ticket.id,
-      name: ticket.name
-    }))
+    type: ACTIVITY_PRODUCT_TYPE2,
+    color: node.access_control_color_hex || "",
+    tickets: []
   };
 }
 
@@ -4193,15 +4221,13 @@ var CngProductService = class {
    * ```
    */
   async getAllActivities() {
-    const body = await this.client.get(
-      PRODUCTS_PATH
-    );
-    const nodes = Array.isArray(body) ? body : body?.products ?? [];
-    return fromProductNodes(nodes ?? []);
+    const body = await this.client.get(PRODUCTS_PATH);
+    return fromProductNodes(body?.data ?? []);
   }
 };
 
 // src/internal/cng/rest-client.ts
+var PERMISSION_SEPARATOR = ": ";
 var RestClient = class {
   constructor(options) {
     this.options = options;
@@ -4214,6 +4240,7 @@ var RestClient = class {
    *
    * @throws {AdminAccountRequiredError} on HTTP 418
    * @throws {RateLimitError} on HTTP 429 after retries are exhausted
+   * @throws {CngPermissionError} on HTTP 403 (app missing a permission)
    * @throws {CngApiError} on any other non-2xx response
    */
   async get(path) {
@@ -4227,6 +4254,11 @@ var RestClient = class {
       path,
       async (response) => {
         const body = await parseBody(response);
+        if (response.status === FORBIDDEN_STATUS) {
+          const permissions = extractMissingPermissions(body);
+          logger.warn(`Missing permission for ${path} (HTTP 403)`, { url, permissions });
+          throw new CngPermissionError(permissions, body);
+        }
         if (!response.ok) {
           logger.error(`CNG request failed with HTTP ${response.status}`, { url });
           throw new CngApiError(response.status, body);
@@ -4243,10 +4275,17 @@ var RestClient = class {
   buildHeaders() {
     return {
       "X-Peek-Auth": `Bearer ${this.options.getToken()}`,
-      "Content-Type": "application/json"
+      "Content-Type": "application/json",
+      [SDK_HEADER_NAME]: SDK_HEADER_VALUE
     };
   }
 };
+function extractMissingPermissions(body) {
+  if (typeof body !== "object" || body === null) return [];
+  const raw = body.errors?.permission;
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((entry) => typeof entry === "string").map((entry) => entry.split(PERMISSION_SEPARATOR).pop().trim()).filter((permission) => permission.length > 0);
+}
 
 // src/cng-access-service.ts
 var DEFAULT_BASE_URL2 = "https://app-registry.peeklabs.com/installations-api";
@@ -4282,7 +4321,7 @@ var CngAccessService = class {
     }
     return this.productService;
   }
-  /** All activities. Delegates to {@link CngProductService.getAllActivities}. */
+  /** All activities. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link CngProductService.getAllActivities}. */
   getAllActivities() {
     return this.getProductService().getAllActivities();
   }
@@ -4377,7 +4416,8 @@ var RestClient2 = class {
   buildHeaders() {
     return {
       "X-Peek-Auth": `Bearer ${this.options.getToken()}`,
-      "Content-Type": "application/json"
+      "Content-Type": "application/json",
+      [SDK_HEADER_NAME]: SDK_HEADER_VALUE
     };
   }
 };
@@ -4416,7 +4456,7 @@ var AcmeAccessService = class {
     }
     return this.productService;
   }
-  /** All activities. Delegates to {@link AcmeProductService.getAllActivities}. */
+  /** All activities. @deprecated The access service exposes only its resource-service accessors; call the service directly instead. See {@link AcmeProductService.getAllActivities}. */
   getAllActivities() {
     return this.getProductService().getAllActivities();
   }
@@ -4602,6 +4642,7 @@ exports.AvailabilityService = AvailabilityService;
 exports.BookingService = BookingService;
 exports.CngAccessService = CngAccessService;
 exports.CngApiError = CngApiError;
+exports.CngPermissionError = CngPermissionError;
 exports.CngProductService = CngProductService;
 exports.DailyNoteService = DailyNoteService;
 exports.INSTALL_STATUSES = INSTALL_STATUSES;